Attention Is the Scarce Resource
Most consumer software is paid to keep you. The revenue model rewards a longer session, a return visit, one more scroll, and so the product is tuned toward those things whether or not they were good for you. The metric that governs the whole industry - engagement - measures time spent, and time spent is the one thing a person cannot get back.
The Priostack app is built on the opposite premise. Attention is the scarce resource, not screen time to be harvested. The job of the software is to work out the single thing that actually deserves your attention right now, ask before it does anything on your behalf, and then get out of the way. When there is nothing worth doing, it says so and closes. Software that wants you gone, not software that wants your evening.
That sentence is easy to write and easy to violate. This piece is about the machinery underneath it - the parts of Qubit, the engine under the app, that make the ethic something you can check rather than something we assert. If a product claims to respect your attention, you should be able to point at the mechanism that enforces the claim. Here is where to point.
Contents
- 1. Why engagement is the wrong metric
- 2. Working out the one thing worth doing
- 3. The autonomy ladder is an attention contract
- 4. You see the side effect before you grant it
- 5. Silence as a first-class state
- 6. Recall by similarity, not a feed
- 7. Attention that never needed a screen
- 8. Where this is honestly hard
1. Why engagement is the wrong metric
Engagement is a proxy. Nobody actually wants your time for its own sake; they want the outcomes that correlate with it - purchases, ad impressions, network effects. But once a proxy becomes the number on the dashboard, the product optimises the proxy directly. The interface learns to interrupt, to withhold, to autoplay, to turn a five-second task into a two-minute visit, because the two-minute visit scores higher.
The damage is not that any single interruption is large. It is that the incentive points the wrong way at every design decision, and thousands of small decisions compound into a product whose interests are structurally opposed to yours. You cannot fix that with a wellbeing screen or a weekly time report bolted onto the side. The metric has to change.
The replacement we build toward is uncomfortable as a business input because it has no natural upper bound to chase: did the app do the smallest correct thing and then leave. A good session might be four seconds. A perfect one might be zero - the app looked, decided nothing needed you, and never lit up. There is no way to make that number go up by manipulating the person, which is precisely why it is the right number.
2. Working out the one thing worth doing
Deciding what deserves attention sounds like the part that needs a large opaque model guessing at your intent. It is not, and the reason is that a Priostack app is not a pile of code trying to infer what should happen next. It is a bundle of formal models that state what is happening, explicitly.
A third-party app ships models, not application code:
- ArchiMate 4.0 describes the structure - the actors, roles, and things the app is made of.
- BPMN 2.0 describes what it does, and Qubit runs those processes natively as Petri nets, so at any moment there is a precise, inspectable answer to which steps are ready.
- CMMN 1.1 handles cases - the loosely structured situations that unfold at their own pace.
- DMN 1.3 holds the decisions, as tables you can read, not weights you cannot.
- Camel routes describe integrations out to the rest of the world, and IFML describes the views you actually see.
Because the running state is a Petri-net marking rather than a hidden variable, "what is ready for this person right now" is a queryable fact, not an inference. The app is not predicting that you might want to do something; it knows a step is enabled and waiting on you. That is the difference between a notification designed to pull you back and a notification that corresponds to a real, ready, consequential task. The first is manufactured. The second is just true.
Ranking those ready tasks into a single most-worthy one is genuine work, and we do not pretend it is solved. But it starts from ground truth about your processes rather than from a model of your weaknesses.
3. The autonomy ladder is an attention contract
The cheapest way to respect attention is to not ask for it - to let the software handle things itself. The cheapest way to abuse trust is exactly the same move. So the amount of independence an app has is not a single switch; it is a five-rung ladder, and you set where it stops.
Two rules make the ladder trustworthy rather than decorative:
- Effective autonomy is the lower of two numbers - what the app is allowed to declare it needs, and what you personally granted. An app cannot climb higher than you set, and a permissive user cannot push an app past what it declared. Both have to agree, and the smaller number wins.
- Money and account-security actions are capped at Confirm, rung 2, no matter what an app asks for. There is no configuration, no premium tier, no "trusted app" flag that lets a payment or a security change happen without you in the loop for that specific act. The cap is structural.
Read the ladder as a statement about attention. At rung 0 the app spends none of it without cause. At rung 3 you have deliberately bought back your attention by delegating - the app acts and reports, so a whole class of small decisions stops reaching you at all. At rung 4 it runs continuously and you retain one power that matters: you can stop it. Higher rungs are not the app taking more; they are you choosing to be interrupted less, on terms you set and can revoke.
4. You see the side effect before you grant it
A permission you cannot understand is not a choice. So a capability does not ask for abstract access; it declares what class of side effect it can have, in plain terms, and you see that class before you grant anything:
read_only | looks, changes nothing |
reversible_local | changes something on your device you can undo |
external_communication | sends something out to someone |
financial_commitment | spends or commits money |
account_security | touches credentials or access |
high_stakes | consequential and not easily walked back |
This is the attention ethic pushed down into the grant screen. You are not asked to trust a vague label; you are told the worst thing this capability could do, and you decide with that in front of you. The last two classes are the ones the Confirm cap protects, and the pairing is deliberate - the actions that can hurt you most are exactly the ones that can never be taken silently.
Anything the models cannot express, the app provides as a permissioned native feature - the camera, a signing key, placing a call. Those are granted with a stated purpose and an expiry, and enforced at the moment they are invoked, not waved through once at install time. A feature you granted for one afternoon's task does not quietly persist as standing access. When the purpose is over, so is the grant.
5. Silence as a first-class state
The hardest thing for attention-farming software to do is nothing. An empty feed is a failure to it, so it manufactures content - a streak reminder, a "people you may know", a badge on an icon for a thing that does not matter. Every one of those is a small theft dressed as a service.
In our model, "there is nothing worth your attention" is a legitimate, common, correct output. Because readiness is grounded in real process state, the app can distinguish an empty queue from a queue it simply has not filled with noise. When nothing is enabled, nothing is ready, and no case is waiting on a human decision, the honest answer is silence - and the app gives it. No invented task, no re-engagement nudge, no badge.
This is only possible because the system has a truthful sense of its own state to consult. A product built on inference has to guess whether it is quiet, and guessing quiet is scary when your revenue depends on activity, so it errs toward noise. A product built on explicit models can look and know, and can afford to be quiet because quiet is not a threat to it.
6. Recall by similarity, not a feed
Context matters - an app that forgets everything makes you re-explain yourself, which is its own tax on attention. Priostack keeps history in a geometric memory, where a step's position is derived from the execution state that produced it. Distance in that space is meaningful, so two situations that unfolded similarly sit near each other, and you can recall past context by similarity rather than by remembering an exact key.
The point for this discussion is what it is not. It is a store the app consults when it has a real reason to, to answer "have we been somewhere like this before". It is not a timeline engineered to be scrolled, not an infinite backlog surfaced to pull you in. Memory here serves the current task and then recedes. It makes the app quicker to reach the one thing worth doing; it is not a place you are meant to dwell.
7. Attention that never needed a screen
The strongest form of respecting attention is a task that is handled well without ever reaching a person at all. The same models that drive the app can run out in the physical world on Skopin, Priostack's Linux edge operating system, on hardware like the Reflex board. A Node in an ArchiMate technology layer can be a real device running Skopin in the field, executing the app's processes and reporting its actual state back.
On a control device, Skopin runs a fast repeating scan cycle, on the order of 120 ms. Sensor conditions become read-only guards, and unsafe interlock states are made structurally unreachable - safety by construction, a property of the Petri-net semantics, rather than a runtime check that might be skipped. The family framing is simple: Priostack orchestrates, Skopin executes at the edge, Reflex anchors it in the physical world.
Because the same engine runs the app, the API, and the edge, the same model means the same thing on every surface - a native mobile app drawing the views, a browser PWA, or a device in a field. And the more the edge handles correctly on its own, the fewer moments have to climb all the way up to interrupt you. The best interruption is the one that a well-specified guard made unnecessary.
8. Where this is honestly hard
None of this makes the problem disappear; it moves it somewhere you can inspect. The honest difficulties:
- Ranking is still judgement. Knowing which tasks are ready is grounded in real state. Deciding which single ready task is the most worthy of you is a genuine ordering problem, and a wrong ranking wastes attention just as surely as a manufactured notification does. The ground truth constrains it; it does not solve it.
- Restraint has to survive a business model. "Software that wants you gone" is an easy thing to mean and a hard thing to keep meaning when incentives shift. The mechanisms here - the autonomy cap, the side-effect classes, silence as a valid output - are the parts we can hold ourselves to, because they are checkable. Intentions are not.
- Less knowledge is a real cost. "It only knows what you tell it" rules out a whole class of anticipatory cleverness that a profile-driven product would attempt. Sometimes that means the app is less prescient than a system willing to surveil you. We take that trade deliberately, and it is a trade, not a free win.
- Memory recalls shape, not meaning. As above - similarity today is structural, not semantic. Useful, bounded, and not what a reader might imagine when they hear "it remembers".
Conclusion
The claim is not that Priostack has abolished the attention economy. It is that we picked a different number to be good at. Instead of maximising time spent, the app is measured by whether it found the one thing worth doing, asked before acting on anything that matters, and left when there was nothing - a metric with no upper bound to game by manipulating you.
What makes that more than a slogan is that each part rests on a mechanism you can check: readiness grounded in Petri-net state rather than inferred, an autonomy ladder capped at Confirm for money and security, side-effect classes shown before you grant, native features scoped to a purpose and an expiry, and silence treated as a correct answer. You do not have to believe our intentions. You can point at the machinery and see where the incentive was removed.